Question

A network engineer at a retail company reports that VMs in a Google Cloud VPC cannot reach an on-premises subnet (10.50.0.0/24) that is connected via HA VPN and a Cloud Router using BGP. Traffic in the reverse direction (on-prem to Google Cloud) works fine. The engineer runs a Connectivity Test from a VM in the VPC to a host at 10.50.0.5, and the test result reports 'Route not found: no matching route for the destination' at the VPC network step. What is the most likely root cause?

Accepted Answer

The Cloud Router is not receiving the 10.50.0.0/24 prefix from the on-premises router over BGP, so no dynamic route was installed in the VPC.

Answer

A firewall rule is denying egress traffic to 10.50.0.0/24, which prevents the route from being used.

Answer

The HA VPN tunnel is administratively down, so all traffic is being dropped at the tunnel interface.

Answer

VPC Flow Logs are disabled on the subnet, so Connectivity Test cannot verify the route exists.